Pursuant to and for the purposes of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter also referred to as the “Regulation” or “GDPR”), which repeals Directive 95/46/EC, we inform you that the personal data you voluntarily make available to Sclavo Vaccines Association ONLUS will be processed in compliance with current legislation on the protection of personal data and, in any case, with the principles of confidentiality and transparency.

1 Data Controller

The Data Controller is Sclavo Vaccines Association E.T.S. (Tax Code 92049180521), with registered office in Siena (SI), at Piazza La Lizza, 7, Telephone: +39 0577 539145, e-mail: info@sclavo.org (hereinafter “SVA”).

2 Personal Data

Personal data means any information that concerns you and is referable to you, including those indicated in Article 9 of the Regulation, called “special categories of personal data”, such as genetic and biometric data, information relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership (hereinafter the “Data”).

Specifically:

Data collected at the time of event registration. You will be asked to provide your identifying Data, including name, surname and email address, new collected data name. Any Data collected during participation in the event Through video recordings, audio recordings and photographs, footage, voice recordings and images may be collected (depending on the type of event organized).

3 Purpose of Processing

The processing of your Data is aimed at:

a) registration and participation in the event; b) sending service communications, such as confirmation and reminder of event registration; c) possible publication and/or dissemination in any form, for informational and/or promotional purposes, of footage, voice recordings and images portraying you during activities carried out in the context of the event on the Company’s website, in print and/or on any other means of dissemination (depending on the type of event organized) to document the realization of the event and promote the activities carried out in this context by SVA; d) communication to third parties and partner companies of the Company that have collaborated in the realization of the event, for attendance tracking and statistical data, as well as food allergies for the preparation of specific meals.

4 Legal Basis of Processing

The processing of your Data for purposes a) and b), indicated in point 3 above, has its legal basis in the legitimate interest of the Company to ensure the normal running of the event. The processing of your Data for purpose c), indicated in point 3 above, has its legal basis in the legitimate interest of the Company to document the realization of the event and promote the activities carried out in this context. The processing of your Data for purposes d), e) and f) indicated in point 3 above, has its legal basis in your specific consent, which you are free to give or not and which you may, in any case, revoke at any time.

5 Nature of Data Provision and Consequences of Refusal

With reference to the purposes indicated in point 3 above, the provision of your Data is mandatory, as it is necessary for participation in the event. Therefore, your refusal to provide your Data will result in the impossibility of participating in the event itself.

6 Methods of Processing

Within the scope of the purposes indicated in point 3 above, the processing of your Data, including any portrait contained in footage / voice recordings / images, will be carried out using electronic means, in compliance with legal provisions regarding the processing of personal data, adopting adequate security measures. SVA emphasizes that the processing of Data you provide at the time of event registration takes place through SVA’s institutional website with forwarding to a specific email address of the same Institution. By registering for the event, the User consents to the storage of their Data on SVA’s email servers.

The processing of your Data will be managed by specially trained and instructed personnel, precisely to ensure its adequate security and confidentiality, as well as to avoid risks of loss and/or destruction and access by unauthorized persons.

7 Communication and Dissemination of Data

Your Data may be communicated to:

• internal subjects within the Company specifically authorized who carry out activities related and instrumental to the management of the requested services;
• subjects specifically appointed as Data Processors;
• third parties and partner companies of the Company involved in the realization of the event.

Within the limits relevant to the processing purposes indicated above, your Data (footage / voice recordings / images) may be subject to publication and/or dissemination in any form on SVA’s website, on SVA’s social channels (Facebook, LinkedIn, Twitter) and/or on any other means of dissemination.

8 Data Retention Period

Your Data will be retained for a period of time not exceeding the achievement of the purposes for which they are processed, in full compliance with the principle of storage limitation provided for by the Regulation and/or for the time necessary for legal obligations.

Verification of the obsolescence of data stored in relation to the purposes for which they were collected is carried out periodically.

9 Data Subject Rights

With reference to your Data, you have the right to request from the Company, in the manner indicated by the Regulation:

• access, in the cases provided for;
• rectification of inaccurate Data and integration of incomplete ones;
• erasure of Data for the reasons provided for, such as when they are no longer necessary in relation to the purposes indicated above or are not processed in compliance with the Regulation;
• restriction of processing for the cases provided for, such as when you contest the accuracy of the Data and it is necessary to verify its correctness;
• portability, that is, the right to receive, in the cases provided for, in a structured, commonly used and machine-readable format, the Data and to transmit said Data to another data controller;
• objection to processing, in the cases provided for.

We also remind you that, with reference to the purposes indicated in point 3 above, you have the right to revoke your consent to the processing of your data at any time, without prejudice to the lawfulness of processing based on consent given before revocation.

10 Methods of Exercising Rights

We inform you that you may exercise the rights referred to in point 9 above through the following methods:

• by writing to Sclavo Vaccines Association at Via Fiorentina 1, 53100 – Siena (SI), to the attention of the Privacy Office;
• by sending an email to info@sclavo.org.

The deadline for response is one (1) month, extendable by two (2) months in case of particular complexity; in these cases SVA will in any case provide at least an interim communication within one (1) month.

The exercise of rights is, in principle, free of charge. SVA reserves the right to request a contribution in case of manifestly unfounded or excessive requests (also repetitive). SVA also reserves the right to request information necessary for identification purposes of the applicant.

11 Complaint

If you believe that the processing of your Data violates the provisions contained in the Regulation, you have the right to lodge a complaint with the Data Protection Authority or, alternatively, to file an appeal with the competent judicial authority.

12 International Data Transfer

Your Data is stored at the Company’s premises and on servers located in the European Union.

SVA also wishes to inform you that the email servers are located in countries outside the EU (USA) and that, for the purposes of international transfer of personal data collected in the European Economic Area (EEA), the email servers adhere to the “Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield” (“Privacy Shield”). For more information in this regard, we invite you to consult the Privacy Policy of Microsoft and Siteground.

13 Automated Decision-Making Processes

The Data is not subject to processing through an automated decision-making process.